CVE-2026-93824
Description
A flaw was found in the Linux kernel's Transport Layer Security (TLS) subsystem. A local user can trigger this vulnerability by configuring TLS keys on a network socket already attached to a Berkeley Packet Filter (BPF) socket map (sockmap). This unsupported integration exposes latent flaws in the networking stack, potentially resulting in memory corruption and a denial of service (DoS).
Statement
A moderate vulnerability was found in the Linux kernel's Transport Layer Security (TLS) offload subsystem as shipped in Red Hat Enterprise Linux. A local user can trigger this flaw by configuring TLS keys on a network socket that is already attached to a Berkeley Packet Filter (BPF) socket map (sockmap). This unsupported TLS and sockmap integration hides a number of latent bugs in the networking stack which are exploitable, potentially resulting in memory corruption and a denial of service (system crash). Red Hat rates this issue as moderate because exploitation requires local access and depends on latent bugs exposed only through this unsupported configuration. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and the Red Hat Enterprise Linux CoreOS 8 and 9 containers used by OpenShift Container Platform are affected; the fix is currently deferred for these products. RHEL 6 and RHEL 7 Extended Life Cycle Support are not affected because the vulnerable code is not present. Until a fixed kernel is released, the residual risk remains that a local user able to combine BPF sockmap functionality with TLS offload on the same socket could trigger a kernel crash or memory corruption, causing a denial of service.
Mitigation
This flaw can be avoided by not using the unsupported combination of kernel TLS (kTLS) and BPF sockmap: do not configure TLS keys on network sockets that are attached to a BPF sockmap, and do not attach sockmap BPF programs to sockets using TLS offload. Systems and workloads that do not combine TLS offload with sockmap are not exposed to this issue. Apart from avoiding this configuration, mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
